Project Management – Who Starts Tasks First in Frontend and Backend Development

A framework/language or any other technology will not save you. By that I mean that Django is not your only option. What you should focus on is the design and do the implementation on the technology you are most familiar with (if this is not just a personal project). Having that in mind, I would try to make both ends as much independent as they can be. That means that ReactJS (or the frontend) should not hold any data, that are not to be presented to the user.

An approach I think would work:

• Create JSON entities with which the front and back ends can talk to each other. E.g. {"query" : "give me something from the DB <NOT SQL>", "id":"random uuid"} with a reply from the middle layer (read below) {"result" : "contains what you need", "id" : "uuid used before"}.
• Create the "second" backend, which in reality is a middle layer, that converts your data to the data the existing data model holds and is responsible for the communication of the front and the existing backend. This layer will do the retrieval of the data, the authentication of the users, push events, etc.
• Avoid mixing the responsibilities of the presentation of the data to user and the actual retrieval of the information. I've already stated that, but keep in mind JS can be debugged in your browser so you don't want sensitive data to exist there.

As for the communication an alternative to AJAX would be websockets.

The only scenario where I can see that configuration is when main API is not published with a public subdomain, so you may mask it publishing an intermediate public “backend” to proxy requests to the API in the private network OR you have a front end-backend (Let’s say a CMS with a different ad-hoc front end in AngularJS, React or any other Client-Side technology ) that consume services from other API, so you have a mix of CMS functionalities and data coming from the other API, I have seen both cases.

Most CORS problems come from misunderstanding of this mechanism. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

If API is publicly exposed, then you just need to configure the Access-Control-Allow-Origin: For the calling subdomain (origin of request) so you only have to worry that nothing is changing headers when they’re sent.

Of course CORS serves for the purpose of safely sharing data between different servers, hosting different applications, as API may reject any request not coming from the subdomain specified at Access-Control-Allow-Origin:

Otherwise having two backends with different or complementary business logic may result on a disaster, as any change done to the front end may easily result in changing code in the two backends which makes it harder to maintain.